An analyst is creating a dashboard widget that shows the total bytes transferred per protocol (HTTP, HTTPS, FTP) for the current month. The events contain `protocol` and `bytesSent`. Which GROUP BY and aggregation combination produces the required output?

GROUP BY protocol, SUM(bytesSent)

GROUP BY bytesSent, SUM(protocol)

GROUP BY protocol, COUNT(bytesSent)

GROUP BY bytesSent, COUNT(protocol)

A large enterprise generates millions of authentication events per day. An analyst needs a report of the top 10 users by failed login count, but the raw event volume makes the query slow. The analyst notices that the `user` field has high cardinality. Which approach best balances accuracy and query performance?

Run the full GROUP BY user with COUNT(*) and ORDER BY count DESC LIMIT 10 on the entire time range

Use a pre-aggregated summary table that stores hourly failed-login counts per user, then GROUP BY user and SUM the counts

GROUP BY user with COUNT(DISTINCT eventID) instead of COUNT(*)

Limit the search to the first 10,000 events and GROUP BY user on that subset

FortinetNSE 6 - FortiSIEM Analyst

Domain 1Objective 2

Apply Group by and Data Aggregation on Search Results NSE6-FORTISIEM-ANALYST Practice Questions (Page 2)

Part of the Analytics domain, which makes up ~18% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 16 practice questions to prepare you well beyond it. (estimate)

16questions here

4free pages

2concepts

Questions 6–10

6foundation · easy
In a FortiSIEM aggregation query, which function returns the number of distinct values for a specified field?
Select an answer first
7application · easy
A SOC manager wants a report showing the average duration of all active directory lockout events per domain controller over the past week. The events have fields `dcName` and `lockDuration` (in seconds). Which aggregation should be applied to the `lockDuration` field when grouping by `dcName`?
Select an answer first
8application · easy
An analyst is creating a dashboard widget that shows the total bytes transferred per protocol (HTTP, HTTPS, FTP) for the current month. The events contain `protocol` and `bytesSent`. Which GROUP BY and aggregation combination produces the required output?
Select an answer first
9expert · hard
A large enterprise generates millions of authentication events per day. An analyst needs a report of the top 10 users by failed login count, but the raw event volume makes the query slow. The analyst notices that the `user` field has high cardinality. Which approach best balances accuracy and query performance?
Select an answer first
10application · medium
A SOC analyst needs to know how many distinct malware families have been detected on each host in the last week. The events contain `hostName` and `malwareFamily`. Which aggregation should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTISIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISIEM-ANALYST” is a trademark of its owner, used for identification only.

Apply Group by and Data Aggregation on Search Results NSE6-FORTISIEM-ANALYST Practice Questions (Page 2)

Questions 6–10

In a FortiSIEM aggregation query, which function returns the number of distinct values for a specified field?

A SOC manager wants a report showing the average duration of all active directory lockout events per domain controller over the past week. The events have fields `dcName` and `lockDuration` (in seconds). Which aggregation should be applied to the `lockDuration` field when grouping by `dcName`?

An analyst is creating a dashboard widget that shows the total bytes transferred per protocol (HTTP, HTTPS, FTP) for the current month. The events contain `protocol` and `bytesSent`. Which GROUP BY and aggregation combination produces the required output?

A SOC analyst needs to know how many distinct malware families have been detected on each host in the last week. The events contain `hostName` and `malwareFamily`. Which aggregation should be used?

Keep studying — Analytics